Security GRC Program Manager, Third Party Risk

A program manager in Stripe's Security Governance, Risk and Compliance team who assesses the security of the third parties Stripe works with. The role runs its own portfolio of third-party security risk assessments for new vendors, renewals and changes in scope, reviewing questionnaires, SOC reports, certifications and pen test results, deciding what remediation is proportionate, and recording outcomes in Zip and Aravo. It escalates high-risk findings into enhanced due diligence and risk acceptance, guides internal teams through the process, tracks program metrics and helps improve policies, standards and tooling.

Stripe wants four or more years in third-party security risk or security assessment, working knowledge of SOC 2, ISO 27001, PCI DSS, NIST and CSA, and the judgement to separate material risks from minor ones. Hybrid in the US.